Morden Antivirus Evasion Techniques Part I

Name: Morden Antivirus Evasion Techniques Part I
Rating: 3.9 (4 reviews)

Antivirus evasion techniques for beginners.

Last updated 9/2022

English

English [Auto],

What you'll learn

7 sections • 24 lectures • 2h 0m total length

Introduction to Antivirus Evasion3:27
You will know what Antivirus Evasion Techniques is.What is the difference between modern antivirus circumvention technology and the past.Why should we learn Antivirus Evasion Techniques.What ideas should we have to better bypass anti-virus software.

((void(*)(void)) & buf)() execute shellcode5:52
Write a minimal shellcode loader.
use virtualAlloc bypass dep7:28
use virtualAlloc bypass dep
use heap space to load shellcode5:58
Explore how Windows heap space loads shellcode by allocating memory, copying the shellcode into the heap, and executing it within an application's lifecycle.
CreateThreadpoolWait to load shellcode5:33
SwitchToFiber to load shellcode4:53
Explore how fiber switching can be used to load and execute shellcode, including allocating executable memory and starting execution at a designated address.
NtTestAlert to load shellcode5:03
Explore how NtTestAlert, an unpublished Microsoft kernel function, detects non-empty queues, dispatches processing, and uses a bound callback after anti-test alert to trigger shellcode.
process injection6:33
The poc of IAT hidden to load shellcode4:14

Learn to use python to bypass anti-virus software9:05
Why not use pyinstaller as much as possible?7:49
Examine why packaging with pyinstaller can trigger antivirus detection and how VirusTotal results reveal why normal executables may look suspicious in security analysis.
Analyze python shellcode loader7:09
Learn to encrypt and decrypt shellcode with Python, load a subsystem dll, and perform process injection by declaring C types and function signatures to ensure compatibility.
Obfuscated code0:36
Discover obfuscated code techniques by using a website to confuse Python code, as part of morden antivirus evasion techniques part i.
Beautiful artifact3:36

You'd better have some experience in C language programming, Windows programming foundation, PE file structure foundation, network security phishing foundation, etc

This is the first part of the course of anti-virus evasion technology. You must learn the basics, and you can go further. The basics here should not be just in my video, there are many more including, PE structure, windows features, windows reverse knowledge, assembly language, C programming features, and learning to use multiple programming languages for antivirus evasion. In the first part, I will talk about the basics of shellcode injection and simple encryption and decryption, which is one of the common methods of modern antivirus evasion technology. In the second part, I will introduce some basics about processes and threads in detail, dll hijacking, dll injection and dll hijacking. technology. There are many different technologies involved in antivirus evasion technology, so I will try my best to provide you with ideas, rather than specific codes. It is meaningless to learn only the code that can bypass antivirus software.
Antivirus evasion technology is a double-edged sword. If you use it to do evil things, I will not bear any legal responsibility. Technology has never been illegal. The key is to see what your purpose is. If it is to enhance your penetration skills, learn the principles of antivirus evasion techniques, I welcome you to my class.